"""
generate_keys.py — One-time RSA-2048 key pair generator for TechDesk licensing.

Run this ONCE on your server to produce the key pair:

    python generate_keys.py

Output:
    private_key.pem  — Keep secret. Never ship to customers.
    public_key.pem   — Paste the contents into license_service.py in TechDesk.

Security notes:
    - private_key.pem must NEVER be committed to git or shipped in any customer build.
    - public_key.pem is safe to embed in TechDesk — it can only verify signatures,
      not forge them.
    - Store private_key.pem on a secure, offline or access-restricted machine.
"""

from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization
import os

KEY_SIZE = 2048
PRIVATE_KEY_FILE = 'private_key.pem'
PUBLIC_KEY_FILE  = 'public_key.pem'


def generate():
    if os.path.exists(PRIVATE_KEY_FILE) or os.path.exists(PUBLIC_KEY_FILE):
        print('Key files already exist. Delete them manually before regenerating.')
        print(f'  {PRIVATE_KEY_FILE}')
        print(f'  {PUBLIC_KEY_FILE}')
        return

    private_key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=KEY_SIZE,
    )

    # Write private key (unencrypted PEM — restrict file permissions after writing)
    private_pem = private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.TraditionalOpenSSL,
        encryption_algorithm=serialization.NoEncryption(),
    )
    with open(PRIVATE_KEY_FILE, 'wb') as f:
        f.write(private_pem)

    # Write public key (PEM)
    public_pem = private_key.public_key().public_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PublicFormat.SubjectPublicKeyInfo,
    )
    with open(PUBLIC_KEY_FILE, 'wb') as f:
        f.write(public_pem)

    # Restrict private key permissions on Unix-like systems
    try:
        os.chmod(PRIVATE_KEY_FILE, 0o600)
    except AttributeError:
        pass  # Windows — manage permissions manually

    print('Key pair generated successfully.')
    print(f'  Private key : {PRIVATE_KEY_FILE}  (KEEP SECRET)')
    print(f'  Public key  : {PUBLIC_KEY_FILE}  (safe to embed in TechDesk)')
    print()
    print('Next steps:')
    print('  1. Copy the contents of public_key.pem into license_service.py (PUBLIC_KEY_PEM constant).')
    print('  2. Never commit or share private_key.pem.')


if __name__ == '__main__':
    generate()